program: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f00000022c0)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000000)=ANY=[@ANYBLOB="280000001d000100000000000000000007000000", @ANYRES8=r3], 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x4080) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, 0x0}], 0x1, 0x44, 0x0, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000640)={0x1, 0x0, [{0xda0}]}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000840)={&(0x7f0000000000)=ANY=[@ANYBLOB="3c0000007a00ffff"], 0x3c}}, 0x0) r7 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x90, 0x0, 0xffffffff00000003, {0x5, 0xfffffffffffffffb, 0x1000000001000000, 0x6, 0x300, 0x5, {0x7, 0xffffffffffffffff, 0x40000000000b, 0xfe2b25c, 0x7fffffffffc, 0x20000006d, 0x25, 0x0, 0x4010, 0x2000, 0x0, 0x0, 0x0, 0x8, 0x2}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VHOST_SET_VRING_BASE(r7, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r7, 0x4028af11, &(0x7f0000000580)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/59, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r7, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r7, 0x4008af03, &(0x7f0000000440)) ioctl$VHOST_VSOCK_SET_RUNNING(r7, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r7, 0x4008af04, &(0x7f0000000040)) r8 = socket$inet_udp(0x2, 0x2, 0x0) close(r8) socket$nl_route(0x10, 0x3, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r8, 0x0, 0x4ffe6, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8924, &(0x7f0000000140)={'lo\x00'}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="0000000001000c0000000000000000000000000a"], 0xd4}}, 0x4001) r9 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r10 = ioctl$KVM_CREATE_VM(r9, 0xae01, 0x0) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl(r11, 0x4048aecb, &(0x7f0000000100)="070000000000000001000000ffffffff") bpf$PROG_LOAD_XDP(0x5, &(0x7f00000002c0)={0x12, 0x4, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000020000000000000006000000711846000000000095000000f7465400000000", @ANYRES32=r2], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0xa, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffeec, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) [ 86.983842][ T5273] Bluetooth: hci0: command tx timeout [ 87.547159][ C0] [ 87.548225][ C0] ============================= [ 87.550256][ C0] [ BUG: Invalid wait context ] [ 87.552346][ C0] syzkaller #0 Not tainted [ 87.554201][ C0] ----------------------------- [ 87.556449][ C0] swapper/0/0 is trying to lock: [ 87.558561][ C0] ffff888013601bb0 (&gpc->lock){....}-{3:3}, at: kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 87.569926][ C0] other info that might help us debug this: [ 87.573675][ C0] context-{2:2} [ 87.575124][ C0] 1 lock held by swapper/0/0: [ 87.581224][ C0] #0: ffff888013602110 (&kvm->srcu){.?.+}-{0:0}, at: kvm_xen_set_evtchn_fast+0x1bc/0x9a0 [ 87.589642][ C0] stack backtrace: [ 87.597070][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 87.597087][ C0] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 87.597094][ C0] Call Trace: [ 87.597102][ C0] [ 87.597107][ C0] dump_stack_lvl+0xe8/0x150 [ 87.597128][ C0] __lock_acquire+0xe39/0x2cf0 [ 87.597144][ C0] ? __lock_acquire+0x683/0x2cf0 [ 87.597157][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 87.597169][ C0] lock_acquire+0x106/0x350 [ 87.597180][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 87.597192][ C0] ? xa_load+0x1db/0x210 [ 87.597251][ C0] _raw_read_lock_irqsave+0x48/0x60 [ 87.597264][ C0] ? kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 87.597276][ C0] kvm_xen_set_evtchn_fast+0x1f4/0x9a0 [ 87.597290][ C0] ? kvm_xen_set_evtchn_fast+0x1bc/0x9a0 [ 87.597302][ C0] xen_timer_callback+0x109/0x220 [ 87.597322][ C0] ? __pfx_xen_timer_callback+0x10/0x10 [ 87.597334][ C0] __hrtimer_run_queues+0x371/0xa10 [ 87.597350][ C0] hrtimer_interrupt+0x448/0x910 [ 87.597366][ C0] __sysvec_apic_timer_interrupt+0x102/0x430 [ 87.597383][ C0] sysvec_apic_timer_interrupt+0xa1/0xc0 [ 87.597396][ C0] [ 87.597400][ C0] [ 87.597404][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 87.597416][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 87.597430][ C0] Code: eb 7c 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d b3 be 16 00 fb f4 4c 07 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 [ 87.597439][ C0] RSP: 0018:ffffffff8e807de0 EFLAGS: 00000242 [ 87.597450][ C0] RAX: 0000000000098d9d RBX: ffffffff819b4450 RCX: 0000000080000001 [ 87.597458][ C0] RDX: 0000000000000001 RSI: ffffffff8e22b6e7 RDI: ffffffff8c4bce80 [ 87.597466][ C0] RBP: ffffffff8e807eb8 R08: ffff88801fc338db R09: 1ffff11003f8671b [ 87.597473][ C0] R10: dffffc0000000000 R11: ffffed1003f8671c R12: 0000000000000000 [ 87.597480][ C0] R13: 1ffffffff1d11de8 R14: 1ffffffff1d00fc4 R15: dffffc0000000000 [ 87.597489][ C0] ? do_idle+0x2e0/0x540 [ 87.597505][ C0] default_idle+0x9/0x20 [ 87.597519][ C0] default_idle_call+0x72/0xb0 [ 87.597532][ C0] do_idle+0x2e0/0x540 [ 87.597545][ C0] ? __pfx_do_idle+0x10/0x10 [ 87.597560][ C0] cpu_startup_entry+0x43/0x60 [ 87.597572][ C0] rest_init+0x2de/0x300 [ 87.597587][ C0] start_kernel+0x392/0x3e0 [ 87.597662][ C0] x86_64_start_reservations+0x24/0x30 [ 87.597674][ C0] x86_64_start_kernel+0x137/0x1b0 [ 87.597685][ C0] common_startup_64+0x13e/0x157 [ 87.597697][ C0]